CVE-2018-18977

CVE-2018-18977 affects the Ascensia Contour NEXT ONE Android app (before 2019-01-15). The issue is weak obfuscation that may allow an attacker to reverse engineer the codebase and extract data contributing to disclosure of patients’ medical information. The connected documents do not provide more...

Privilege Escalation

Oracle MySQL Server and MariaDB are vulnerable to privilege escalation attacks. A local user can exploit a flaw in the MyISAM component to partially modify data and cause denial of service and disclosure of information...

ALPINE-CVE-2019-11598

In ImageMagick 7.0.8-40 Q16, there is a heap-based buffer over-read in the function WritePNMImage of coders/pnm.c, which allows an attacker to cause a denial of service or possibly information disclosure via a crafted image file. This is related to SetGrayscaleImage in MagickCore/quantize.c...

UBUNTU-CVE-2019-11597

In ImageMagick 7.0.8-43 Q16, there is a heap-based buffer over-read in the function WriteTIFFImage of coders/tiff.c, which allows an attacker to cause a denial of service or possibly information disclosure via a crafted image file...

The vulnerability of the OpenJDK application development software suite in Java language lies in access control errors, which allow attackers to disclose protected information or circumvent restrictions within the isolated software environment.

The vulnerability of the OpenJDK application development software suite in Java language is related to errors in access control when code is executed from untrusted sources. Exploiting this vulnerability can allow a malicious actor to disclose information or circumvent restrictions within a...

CVE-2019-2038

In rwi93processsysinfo of rwi93.cc, there is a possible out-of-bound read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: Android-7.0 Android-7.1...

Uber: Sensitive user information disclosure at bonjour.uber.com/marketplace/_rpc via the 'userUuid' parameter

It was possible for an attacker to insert another user’s UUID into the userUuid POST parameter when making a request to https://bonjour.uber.com/marketplace/rpc?rpc=getConsentScreenDetails, allowing them to retrieve personal data from the victim user’s account, as well as the user's mobile auth...

The vulnerabilities in Microsoft Edge and Internet Explorer stem from insufficient validation of input data, allowing attackers to compromise the confidentiality of protected information.

The vulnerabilities of Microsoft Edge and Internet Explorer exist due to insufficient validation of input data. Exploiting these vulnerabilities allows a malicious actor to compromise the confidentiality of protected information through a specially created web page...

Security Bulletin: IBM QRadar SIEM is vulnerable to Information Exposure (CVE-2018-1729)

Summary The product discloses sensitive information to unauthorized users. The information can be used to mount further attacks on the system. Vulnerability Details CVEID: CVE-2018-1729 Description: IBM QRadar discloses sensitive information to unauthorized users. The information can be used to...

Oracle WebLogic Server Component Information Disclosure Vulnerability (CNVD-2019-27110)

Oracle Fusion Middleware Oracle Fusion Middleware is a set of business innovation platforms for enterprise and cloud environments from Oracle. The platform provides middleware, software collection, etc. WebLogic Server is one of the application server components for cloud and traditional...

The vulnerability of the XRef::getEntry function in the Poppler PDF rendering library, related to reading beyond the allowed buffer data limits, allows an attacker to access confidential information or cause service failures.

The vulnerability of the XRef::getEntry function in the Poppler PDF viewer library relates to reading data beyond the allowed buffer size. Exploiting this vulnerability allows an attacker to gain access to confidential information or cause service failures by using a specially crafted PDF documen...

CVE-2019-5520

VMware ESXi 6.7 before ESXi670-201904101-SG and 6.5 before ESXi650-201903001, Workstation 15.x before 15.0.3 and 14.x before 14.1.6, Fusion 11.x before 11.0.3 and 10.x before 10.1.6 updates address an out-of-bounds read vulnerability. Exploitation of this issue requires an attacker to have access...

The numerous vulnerabilities in the FortiOS operating system, related to the lack of protection for service data, allow attackers to disclose the protected information.

The multiple vulnerabilities of the FortiOS operating system are related to the lack of protection for service data. Exploiting these vulnerabilities can allow a malicious actor to disclose sensitive information by analyzing HTTP headers, certificates, and error messages...

The vulnerability of the Secure Storage component in Cisco IOS XE and Cisco IOS operating systems allows attackers to disclose protected information.

The vulnerability of the Secure Storage component in Cisco IOS XE and Cisco IOS systems is related to the lack of protection for service data. Exploiting this vulnerability can allow attackers to disclose the protected information...

Nextcloud: Combination of content provider allows private data disclosure

Good afternoon. Sorry, its me again .. I use NC on a daily basis so I often makes some checks .. As per 489105, document thumbnail shall not be disclosed. The exposure on thumbnailCache/ is an already know issue. However, malicious apps are still able to extract at least pictures and text files b...

PT-2019-6027 · Adobe +1 · Flash Player +1

Name of the Vulnerable Software and Affected Versions: Adobe Flash Player versions 32.0.0.156 and earlier Description: The issue is related to an out-of-bounds read in memory, which could allow a remote attacker to disclose protected information. This is a result of a vulnerability in the softwar...

UBUNTU-CVE-2019-11006

In GraphicsMagick 1.4 snapshot-20190322 Q8, there is a heap-based buffer over-read in the function ReadMIFFImage of coders/miff.c, which allows attackers to cause a denial of service or information disclosure via an RLE packet...

CVE-2018-1885

IBM Business Automation Workflow 18.0.0.0, 18.0.0.1, and 18.0.0.2 could allow an unauthenticated attacker to obtain sensitve information using a specially cracted HTTP request. IBM X-Force ID: 152020...

The vulnerability of the Array.prototype.slice method in JIT-compiler IonMonkey of the Firefox ESR browser allows an attacker to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the Array.prototype.slice method in JIT-compiled Firefox ESR browser software arises due to buffer overflow. Exploiting this vulnerability can allow an attacker to compromise the confidentiality, integrity, and accessibility of protected information...

The vulnerability of the BlockIo service’s Tianocore edk2 library allows a hacker to escalate their privileges, disclose protected information, or cause a service failure.

The vulnerability of the BlockIo service for the Tianocore edk2 library arises from insufficient validation of the data entered by users. Exploiting this vulnerability can allow a malicious actor to enhance their privileges, disclose sensitive information, or cause service failures...